Elog
CVE-2019-3996
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.
AnalysisAI
ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-441. ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. Affected products include: Elog Project Elog, Fedoraproject Fedora.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. Rated h
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. Rated high severi
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. Rated high severity (CVSS 7.5), thi
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. Rated high severity (CVSS 7.5), thi
elog 3.1.1 allows remote attackers to post data as any username in the logbook. Rated high severity (CVSS 7.5), this vul
Configuration file manipulation in ELOG electronic logbook system allows authenticated attackers to trigger denial of se
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today